4.19-stable patches

added patches:
	fortify-explicitly-disable-clang-support.patch

diff --git a/queue-4.19/fortify-explicitly-disable-clang-support.patch b/queue-4.19/fortify-explicitly-disable-clang-support.patch
new file mode 100644 (file)
index 0000000..f9d8501
--- /dev/null
+++ b/queue-4.19/fortify-explicitly-disable-clang-support.patch
@@ -0,0 +1,47 @@
+From a52f8a59aef46b59753e583bf4b28fccb069ce64 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Wed, 12 May 2021 21:51:10 -0700
+Subject: fortify: Explicitly disable Clang support
+
+From: Kees Cook <keescook@chromium.org>
+
+commit a52f8a59aef46b59753e583bf4b28fccb069ce64 upstream.
+
+Clang has never correctly compiled the FORTIFY_SOURCE defenses due to
+a couple bugs:
+
+       Eliding inlines with matching __builtin_* names
+       https://bugs.llvm.org/show_bug.cgi?id=50322
+
+       Incorrect __builtin_constant_p() of some globals
+       https://bugs.llvm.org/show_bug.cgi?id=41459
+
+In the process of making improvements to the FORTIFY_SOURCE defenses, the
+first (silent) bug (coincidentally) becomes worked around, but exposes
+the latter which breaks the build. As such, Clang must not be used with
+CONFIG_FORTIFY_SOURCE until at least latter bug is fixed (in Clang 13),
+and the fortify routines have been rearranged.
+
+Update the Kconfig to reflect the reality of the current situation.
+
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Acked-by: Nick Desaulniers <ndesaulniers@google.com>
+Link: https://lore.kernel.org/lkml/CAKwvOd=A+ueGV2ihdy5GtgR2fQbcXjjAtVxv3=cPjffpebZB7A@mail.gmail.com
+Cc: Nathan Chancellor <nathan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ security/Kconfig |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/security/Kconfig
++++ b/security/Kconfig
+@@ -191,6 +191,9 @@ config HARDENED_USERCOPY_PAGESPAN
+ config FORTIFY_SOURCE
+       bool "Harden common str/mem functions against buffer overflows"
+       depends on ARCH_HAS_FORTIFY_SOURCE
++      # https://bugs.llvm.org/show_bug.cgi?id=50322
++      # https://bugs.llvm.org/show_bug.cgi?id=41459
++      depends on !CC_IS_CLANG
+       help
+         Detect overflows of buffers in common string and memory functions
+         where the compiler can determine and validate the buffer sizes.

diff --git a/queue-4.19/series b/queue-4.19/series
index 7c7866b5789f3ae2f207ca79bf90c96948f5c0bb..8a64e06d57264f0329541936e9dcf781b7e1a554 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -249,3 +249,4 @@ pci-add-pci_exp_devctl_payload_-macros.patch
 fuse-truncate-pagecache-on-atomic_o_trunc.patch
 x86-cpu-fix-migration-safety-with-x86_bug_null_sel.patch
 ext4-fix-lazy-initialization-next-schedule-time-computation-in-more-granular-unit.patch
+fortify-explicitly-disable-clang-support.patch